CVE-2026-102298 - Insufficient Authorization and User Boundary Validation in Omada Controller MSP
CVE-2026-102298 - Insufficient Authorization and User Boundary Validation in Omada Controller MSP
A new vulnerability, CVE-2026-102298, has been reported. In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts. 🚨
Affected Products
The following products are affected by the CVE-2026-102298 vulnerability:
- Tp-link omada_software_controller
Details concerning this vulnerability were officially added on October 14, 2026. The added description states: “In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.” 🔍
CVSS and CWE Information
This vulnerability has been assigned CVSS V4.0 and categorized with CWE-639 and CWE-862. For additional information and support, the following references have been provided:
To read the complete article see: Read full article